I've heard it claimed that IPv6 was supposed to bake in IPsec as part of the core protocol which I think would have given you what you want, but 1. obviously that's not how history actually turned out, and 2. honestly I'm kind of glad that it didn't because I would rather not be stuck with IPsec forever.